{ "id": "610427a6-b3e5-46ac-a8fa-ce688fc5d5c9", "created_at": "2026-04-06T00:11:29.296026Z", "updated_at": "2026-04-10T13:12:17.254575Z", "deleted_at": null, "sha1_hash": "c25773da620640e551e32f7ab0a64fe8c236853c", "title": "Hacktivists take sides in Israel-Palestinian war", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 87092, "plain_text": "Hacktivists take sides in Israel-Palestinian war\r\nBy Daryna Antoniuk\r\nPublished: 2023-10-10 · Archived: 2026-04-05 14:22:44 UTC\r\nPolitically-motivated hackers from all over the world have leapt into the escalating conflict between Israel and the\r\nPalestinian group Hamas.\r\nHacktivists are using tactics similar to what was seen at the beginning of the Ukraine-Russia war: leaking stolen\r\ndocuments and launching distributed denial-of-service and defacement attacks on government websites, media\r\noutlets, and critical infrastructure.\r\nThe recent surge in hacktivism comes on the heels of the Red Cross issuing ethical guidelines for civilian hackers\r\nparticipating in armed conflicts, encouraging them to be more \"humane.\"\r\nSince Hamas fighters launched their assault on Saturday, nearly 60 groups have targeted entities connected with\r\neither Palestine or Israel, mostly with denial-of-service attacks (DDoS) attacks.\r\nRead More: Social media platforms foment disinformation about war in Israel\r\nCyberattacks on Israel have mainly come from hacktivists based in Russia, Bangladesh, Pakistan, Morocco, and\r\nIran, according to Will Thomas, a cyber threat intelligence researcher who has been monitoring the activity.\r\nThe attacks include sharing credentials for Israeli websites, leaking stolen data, launching DDoS attacks, and\r\nhijacking application programming interfaces (APIs) to send mobile push messages, he said.\r\nOn Sunday, the pro-Palestinian hacktivist group AnonGhost exploited an API bug in the RedAlert app, which\r\nprovides Israelis with real-time missile warnings, to send a fake threat of nuclear attack, according to the\r\ncybersecurity firm Group-IB. The Red Alert app has over one million downloads on the Google Play store.\r\n“Hacktivists are generally associated with conducting small-scale DDoS attacks and defacement. However, as the\r\nongoing conflict shows, their actions can be far more devastating and costly,” the researchers said.\r\nAnonGhost also claimed that it had hacked an Israeli flight booking website and the official app used by police\r\nofficers in the Israel Defense Forces. The group shared the National Cyber Directorate head's phone number,\r\nencouraging others to spam him.\r\n“We are very proud that we are defending Palestine. It's a duty to try to establish peace for humanity, spreading\r\nawareness. As you can see religion doesn't make us different, or nationality, we are united together,\" the hackers\r\nsaid on Telegram.\r\nOne of the most active Russian hacktivist groups, Killnet, also sided with Hamas.\r\nOn Sunday, the group posted a message on Telegram accusing the Israeli government of supporting Ukraine\r\nduring the war with Russia and warning of cyberattacks.\r\nhttps://therecord.media/hacktivists-take-sides-israel-palestinian\r\nPage 1 of 4\n\n\"You've betrayed Russia. We will target all Israeli government systems with our attacks!\" the group said.\r\nKillnet then claimed that it had taken down an Israeli government website and the website of the security agency\r\nShin Bet. Both websites were indeed offline for a period on Sunday.\r\nIn the past, Moscow has tried to act as a mediator in the conflict and play both sides, but its growing military\r\nalliance with Iran, an enemy of Israel and supporter of Hamas, has complicated the situation.\r\nAnonymous Sudan, a religiously-motivated hacker group, said it is behind an attack on the Jerusalem Post, Israel's\r\nmost-read English news website. As of Tuesday morning, the website was still down.\r\nThe Jerusalem Post has been targeted by multiple cyberattacks this morning causing our site to crash.\r\nWe'll be back soon and will continue to be the top source of information on Operation Swords of Iron\r\nand the murderous attacks by Hamas. pic.twitter.com/6S2GOl6Wma\r\n— The Jerusalem Post (@Jerusalem_Post) October 8, 2023\r\nOn Tuesday, Anonymous Sudan also claimed to have teamed up with the hacking group SiegedSec to target Israeli\r\nindustrial control systems and navigational satellite systems.\r\nAnti-Hamas hacktivist attacks\r\nFewer hacktivist groups have come out in support of Israel.\r\nThe Indian Cyber Force, a pro-India group known for its recent attacks on the Canadian military website, claimed\r\nresponsibility for targeting a Palestinian telecommunications company, the National Bank's website, a government\r\nwebmail service, and the official Hamas website. As of Tuesday morning, most of these websites were\r\ninaccessible.\r\nIn response, pro-Palestinian hackers launched cyberattacks on Indian government websites on Tuesday, accusing\r\nIndia of supporting Israel. Indian cyber officials said they had successfully countered these attacks.\r\nOther pro-Israel hacking groups include the India-linked Team UCC Ops, the relatively new and previously\r\nunknown hacktivist gangs Garuna Ops and SilenOne.\r\n— CyberKnow (@Cyberknow20) October 8, 2023\r\nSome hacktivists, meanwhile, have chosen to attack both sides.\r\n“As you might know, we don't like Israel, but we also don't like war! So, as we have attacked Israel in the past, we\r\nnow attack the Gaza region,” the hacker group ThreatSec wrote on Telegram.\r\nThe group claimed it hacked a major Gaza internet provider called AlfaNet. When asked about the attack by\r\nWired, AlfaNet said that its communications were disrupted because the headquarters had been completely\r\ndestroyed, but the company did not mention any cyberattacks.\r\nChaos and uncertainty\r\nhttps://therecord.media/hacktivists-take-sides-israel-palestinian\r\nPage 2 of 4\n\nAs is common with hacktivist activity, not all of the claimed attacks are real. Some groups are merely seeking\r\nattention, while others want to fuel the disinformation and propaganda surrounding the conflict. Many of the\r\nattacks couldn’t be independently verified.\r\nOn Sunday, the pro-Iranian hacker group Cyber Avengers claimed it successfully attacked Dorad power plant in\r\nIsrael, but researchers discovered that the data posted was actually stolen by the ransomware gang MosesStaff\r\nback in 2022.\r\n“This is yet another example of how hacktivists try to generate hype by posting data from past attacks and\r\nmasquerading them as recent ones in order to attract attention,” Group-IB said.\r\nDigital attacks on Israel began long before Hamas launched its surprise attack.\r\nAccording to a recent report from Microsoft, Israel is the most frequently targeted country for cyberattacks in the\r\nMiddle East. This year, researchers have observed a surge in activity originating from the Gaza-based group\r\nknown as Storm-1133, focusing on Israeli energy, defense, and telecom sectors.\r\nAdditionally, Iran, a longstanding ally of Hamas, has conducted influence operations in the region to support\r\nPalestinian resistance, sow panic among Israeli citizens, and counter the normalization of Arab-Israeli relations,\r\naccording to Microsoft.\r\nhttps://therecord.media/hacktivists-take-sides-israel-palestinian\r\nPage 3 of 4\n\nDaryna Antoniuk\r\nis a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in\r\nEastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for\r\nForbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.\r\nSource: https://therecord.media/hacktivists-take-sides-israel-palestinian\r\nhttps://therecord.media/hacktivists-take-sides-israel-palestinian\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia" ], "origins": [ "web" ], "references": [ "https://therecord.media/hacktivists-take-sides-israel-palestinian" ], "report_names": [ "hacktivists-take-sides-israel-palestinian" ], "threat_actors": [ { "id": "e53fc09e-24cc-40d4-b38d-7e2d6dbe81d8", "created_at": "2023-03-17T02:01:50.851615Z", "updated_at": "2026-04-10T02:00:03.362605Z", "deleted_at": null, "main_name": "Anonymous Sudan", "aliases": [], "source_name": "MISPGALAXY:Anonymous Sudan", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "c29ed071-678d-4023-a954-7138fb534056", "created_at": "2023-11-05T02:00:08.079228Z", "updated_at": "2026-04-10T02:00:03.39948Z", "deleted_at": null, "main_name": "SiegedSec", "aliases": [], "source_name": "MISPGALAXY:SiegedSec", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "bef06c82-0f51-44ba-8451-049cd4ad8a52", "created_at": "2023-01-06T13:46:39.325635Z", "updated_at": "2026-04-10T02:00:03.288171Z", "deleted_at": null, "main_name": "MosesStaff", "aliases": [ "Moses Staff", "Marigold Sandstorm", "DEV-0500", "VENGEFUL KITTEN" ], "source_name": "MISPGALAXY:MosesStaff", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "75108fc1-7f6a-450e-b024-10284f3f62bb", "created_at": "2024-11-01T02:00:52.756877Z", "updated_at": "2026-04-10T02:00:05.273746Z", "deleted_at": null, "main_name": "Play", "aliases": null, "source_name": "MITRE:Play", "tools": [ "Nltest", "AdFind", "PsExec", "Wevtutil", "Cobalt Strike", "Playcrypt", "Mimikatz" ], "source_id": "MITRE", "reports": null }, { "id": "b4a6d558-3cba-499c-b58a-f15d65b7a604", "created_at": "2023-01-06T13:46:39.346924Z", "updated_at": "2026-04-10T02:00:03.295317Z", "deleted_at": null, "main_name": "Killnet", "aliases": [], "source_name": "MISPGALAXY:Killnet", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "e3eca3b8-5c00-4d5b-997f-61450ecd598a", "created_at": "2024-01-09T02:00:04.20862Z", "updated_at": "2026-04-10T02:00:03.513149Z", "deleted_at": null, "main_name": "Threatsec", "aliases": [], "source_name": "MISPGALAXY:Threatsec", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "d64de7e1-4ba3-43c4-9b69-932976b604fc", "created_at": "2023-11-07T02:00:07.111305Z", "updated_at": "2026-04-10T02:00:03.412326Z", "deleted_at": null, "main_name": "Storm-1133", "aliases": [], "source_name": "MISPGALAXY:Storm-1133", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434289, "ts_updated_at": 1775826737, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/c25773da620640e551e32f7ab0a64fe8c236853c.pdf", "text": "https://archive.orkl.eu/c25773da620640e551e32f7ab0a64fe8c236853c.txt", "img": "https://archive.orkl.eu/c25773da620640e551e32f7ab0a64fe8c236853c.jpg" } }